logs
the carrier
a secret on its own is a flare. steganography gives it a carrier that already belongs on the wire. the carrier changes who bothers to look.
the ordinary file
encryption closes the letter. it does not make the envelope uninteresting. an encrypted blob arriving at the wrong hour, from the wrong host, with no ordinary reason to exist, is still a useful mark.
a carrier supplies that ordinary reason. a photograph in a shared folder has a place in the traffic. an audio file in a spool has a place there too. the hidden payload borrows the story already told by the file.
this is an attention problem, not a spell. the carrier has a shape, a size, a sender, and a route. those things still matter.
two locks
a hidden message deserves encryption before it enters the carrier. concealment can fail when a file is recompressed, re-encoded, stripped of metadata, or simply inspected by somebody patient. the payload should still be closed when the carrier is opened.
$ gpg --symmetric --output note.gpg note.txt
$ steghide embed -cf carrier.jpg -ef note.gpg
the first command protects the message. the second changes its address. they solve different problems and fail in different ways.
the bad carrier
a file that appears only to carry a secret has no cover. fake activity produces its own pattern. a single photograph sent once to an account that never receives photographs makes a cleaner marker than the encrypted file it replaced.
the useful carrier comes from a real habit. it is expected by the recipient. it follows the same route as its neighbors. it survives the transformations that route normally applies.
a carrier works when it has a life without the message.
the limit
steganography does not erase risk. it moves the question from what a message says to whether a file deserves attention. traffic analysis still watches the schedule. forensic tools still compare bits. ordinary files still have history.
that limit is the rule. do not ask a hidden channel to make a dangerous act safe. use it to avoid making the rare packet the loudest thing in the room.
if the carrier needs the hidden message to make sense, it is a marker.